Spotify, the popular music streaming service, has been fined $5.4 million by the Swedish privacy protection authority for alleged non-compliance with EU regulations on user data access. The fine was issued after a complaint filed in 2019 by an individual represented by NOYB (None of your business), a privacy rights advocacy group. The complaint accused Spotify of violating the EU’s General Data Protection Regulation (GDPR), specifically Section 15 which requires digital services to provide detailed information to users about their stored data, recipients, and reasons for sharing.
BeatCurry Team
The Swedish Data Protection Authority, known as IMY, launched an investigation into Spotify following the complaint. However, the process took several years without a decision, which NOYB claimed violated GDPR rules that require a prompt resolution within one month. NOYB took the matter to court in Sweden, arguing that the complainant had the right to request a decision from IMY. In November 2022, the court ruled in favor of the complainant, and on June 13, 2023, IMY finally issued its decision.
IMY stated that it found shortcomings in Spotify’s procedures for handling user access requests, particularly in providing clear information and descriptions of data in technical log files. As a result, IMY imposed an administrative fine of SEK 58 million (approximately $5.4 million) on Spotify. The investigation also revealed that Spotify had mishandled access requests related to two other complaints.
Stefano Rossetti, a privacy lawyer at NOYB, emphasized that users have a fundamental right to obtain comprehensive information about the data processed concerning them. However, the lengthy duration of the case, spanning over four years, and the need to litigate against IMY to reach a decision raised concerns about the speed of the Swedish authority’s procedures.
Spotify responded to the fine by asserting that it provides comprehensive information about its data processing practices to all users. The company disagreed with IMY’s decision and plans to appeal. Notably, in a 2022 privacy review conducted by the Common Sense Privacy Program, Spotify received a score of 57 out of 100, accompanied by a “warning” label. The review highlighted concerns regarding unauthorized access, data sale prevention, and adherence to student data privacy laws.
NOYB has criticized the slow response of data protection authorities in other EU countries, stating that out of the eight complaints filed by the organization in 2019 against various digital companies, including Apple Music, Netflix, SoundCloud, and YouTube, only four have seen progress, while the remaining authorities have not responded.
This is not Spotify’s first controversy involving user privacy. In 2015, co-founder and CEO Daniel Ek issued an apology after the DSP attempted to change its privacy conditions, and requested users’ permission to access their photos, contacts and other personal information.
While Spotify plans to challenge the fine, this case underscores the importance of transparency and compliance with data protection regulations for digital service providers, emphasizing the rights of individuals to access and understand how their personal data is being processed.
Related reviews and articles you’d like to see:
Subscribe to BeatCurry’s YouTube Channel here
Check out our Web Stories: Interesting scoops, trivia, stories, industry news delivered at your fingertips.
Watch: Exclusive interview with World’s Fastest Guitarist Davide Lo Surdo
Watch: Exclusive interview with GRAMMY awardee, Pt. Vishwa Mohan Bhatt
Follow us: We’re trending on Instagram
Exclusive Music Review: Mali Delivers An Ode To Each Broken, Hurt Heart Through ‘Ashes’
Exclusive Music Reviews: Mame Khan’s ‘Desert Rose’ Recites The Heartfelt Journey Of Life
Explore: #BeatCurryShorts NOW!
Explore: Check out the BeatCurry Podcast HERE!
If you’d like to know about the unique and versatile forms and flavors of music, follow us on Instagram, YouTube and Facebook, subscribe to BeatCurry.com and never miss another update from us.